Conventional adversarial attacks are effective but difficult for a human to interpret.
These attacks tend to be imperceptible and, when exaggerated, typically appear as random or mildly-textured noise [1]}, [2]}
Some works have used perturbations inside the latents of image generators to synthesize more describable synthetic attacks [3]}, [4]}, [5]}, [6]}, [7]}, [8]}, [9]}, [10]}, [11]}.
These works, however, have not been interpretability-oriented and have only studied small networks trained on simple datasets (MNIST [12]}, Fashion MNIST [13]}, SVHN [14]}, CelebA [15]}, BDD [16]}, INRIA [17]}, and MPII [18]}).
In the trojan detection literature, some methods have aimed to reconstruct trojan features using regularization and transformations, but have thus far been ineffective for recognizably reconstructing feature-level trojans [19]}, [20]}.
Other diagnostic methods for DNNs involve zero-order searches over a fixed set of describable perturbations to images such as style transfers, corruptions, transformations, or feature-additions [21]}, [22]}.
